f5vpn-ng
MEDIUM
maintainer zrhoffman
17 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package installs a prebuilt executable (DEB) from a non-whitelisted but plausibly official host (cdn.f5.com, f5networks.net), and applies a setuid bit to the binary, creating a potential privilege escalation risk if the binary is compromised or malicious; however, it is likely intended for legitimate operation given the vendor context.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:10
'license.html::https://cdn.f5.com/product/apm/apps/eula.html') -
PKGBUILD:11
source_aarch64=("linux_${_pkgname}-${pkgver}.aarch64.deb::https://${mirror}/public/download/linux_${_pkgname}.aarch64.deb")
Medium
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
PKGBUILD:40
chmod u+s "${srcdir}/usr/share/${pkgname}/svpn"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package installs a prebuilt executable (DEB) from a non-whitelisted but plausibly official host (cdn.f5.com, f5networks.net), and applies a setuid bit to the binary, creating a potential privilege escalation risk if the binary is compromised or malicious; however, it is likely intended for legitimate operation given the vendor context.
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: Tess Hoffman <tess@zrhoffman.net>
2
_pkgname=f5vpn
3
pkgname=${_pkgname}-ng
4
pkgver=7274.0.0.2
5
pkgrel=1
6
pkgdesc='VPN client using the Point-to-Point Protocol to connect to F5Networks BIG-IP APM'
7
arch=(aarch64 x86_64)
8
mirror=vpn.f5networks.net
9
source=('com.f5.f5vpn.service' 'desktop-file-dbus.patch'
10
'license.html::https://cdn.f5.com/product/apm/apps/eula.html')
11
source_aarch64=("linux_${_pkgname}-${pkgver}.aarch64.deb::https://${mirror}/public/download/linux_${_pkgname}.aarch64.deb")
12
source_x86_64=("linux_${_pkgname}-${pkgver}.x86_64.deb::https://${mirror}/public/download/linux_${_pkgname}.x86_64.deb")
13
sha256sums=('0c26681df93149e4339bc2de9aaf92ef4ed4cb926b8e127da72113d02c0923e5'
14
'c71a54a47cae863a095d03cee6b1b97c4fee49f799927abd13f44bd2374988bf'
15
'4507e09374f3e6044952f375e4a1af31505b267c4e0bb066ff159e85694a3d6e')
16
sha256sums_aarch64=('dfa67ed13c789be962c11a57dbcde3d0cac6ab90ac3b307145faf79d729b5044')
17
sha256sums_x86_64=('e232c34fe10e9a5c869188a18cb7e89bfd7b9975c55ef1617e3773d9d4ed1d2a')
18
b2sums=('b2b3e60a956a4d55e12695d3a034832af321c57a3da6a907600062c723d8eb44b53473effb8346a3aef9e3423378e74e28b3f1d9ea643d19b4d7ebc4034880a6'
19
'62cac1949c36ca2d6f74f72d83e953d9cc95d7cee60acb3f03afcdce71b00e10e3e22613c206858e94a1a91076917cb28d9b2a75133120a344a93fc4a6c6cefc'
20
'234729d2ff102638d649e46aa7da193f3a46af396cf063876cbabb71b946ef2df4731519acc48f87e2a2d51f52e45ce494e04320a3fa006fbe5fb734820f51d8')
21
b2sums_aarch64=('e9a83fde7f4d7025e94e6e520d090981d707de7efc11a332e4acc3f25ab48578138ab52add23c871a9fa18dcd168ab93053e9b28bc4e2b6497e706b8da8ce2ff')
22
b2sums_x86_64=('48813601eb57a9e8a91766e847fa1eb3826cf0ffc1925305def8b53d2cabf3dd90cbd427e87a52009176ae75b73c304debc5da33be87ba886b76b6a237613639')
23
depends=(curl gtk3 openssl icu libxml2-legacy webkit2gtk-4.1)
24
optdepends=(
25
'xorg-xwayland: wayland support'
26
)
27
provides=("${pkgname}")
28
conflicts=("${_pkgname}")
29
url='https://techdocs.f5.com/kb/en-us/products/big-ip_apm/releasenotes/related/relnote-edge-client-7-2-7-2.html'
30
license=('commercial')
31
32
pkgver() {
33
tar -xf data.tar.xz
34
grep -oEm1 --text '[0-9]+(\.[0-9]+){3}' "usr/share/${pkgname}/svpn"
35
}
36
37
package() {
38
# f5vpn-ng should not be run as root, but it calls svpn which must be privileged to run ip commands
39
# TODO: Make a dedicated f5vpn service account own and run svpn.
40
chmod u+s "${srcdir}/usr/share/${pkgname}/svpn"
41
42
(
43
cd "${srcdir}/usr/share/applications"
44
patch -i "${srcdir}/desktop-file-dbus.patch"
45
)
46
install -Dm644 "com.f5.f5vpn.service" "${pkgdir}/usr/lib/systemd/user/com.f5.${_pkgname}.service"
47
install -Dm644 'license.html' "${pkgdir}/usr/share/licenses/${_pkgname}/license.html"
48
install -dm755 "${pkgdir}/usr/local/lib/F5Networks/SSLVPN/var/run" # For svpn.pid
49
50
cp -a usr "${pkgdir}"
51
}
52
Changes since previous scan
--- PKGBUILD @ 2026-10-31 00:07+++ PKGBUILD @ 2026-11-01 00:21@@ -1,8 +1,8 @@ # Maintainer: Tess Hoffman <tess@zrhoffman.net> _pkgname=f5vpn pkgname=${_pkgname}-ng-pkgver=7272.0.0.2-pkgrel=3+pkgver=7274.0.0.2+pkgrel=1 pkgdesc='VPN client using the Point-to-Point Protocol to connect to F5Networks BIG-IP APM' arch=(aarch64 x86_64) mirror=vpn.f5networks.net@@ -12,14 +12,14 @@ source_x86_64=("linux_${_pkgname}-${pkgver}.x86_64.deb::https://${mirror}/public/download/linux_${_pkgname}.x86_64.deb") sha256sums=('0c26681df93149e4339bc2de9aaf92ef4ed4cb926b8e127da72113d02c0923e5' 'c71a54a47cae863a095d03cee6b1b97c4fee49f799927abd13f44bd2374988bf'- 'SKIP')-sha256sums_aarch64=('32c1ad9ac210b0642ddf2fba5f047372183135bd821a46083bb78b0ba864fefc')-sha256sums_x86_64=('53c6fc43643200b90aac3d4a0b21e163b6e235d11b51bce1695aec083cf79059')+ '4507e09374f3e6044952f375e4a1af31505b267c4e0bb066ff159e85694a3d6e')+sha256sums_aarch64=('dfa67ed13c789be962c11a57dbcde3d0cac6ab90ac3b307145faf79d729b5044')+sha256sums_x86_64=('e232c34fe10e9a5c869188a18cb7e89bfd7b9975c55ef1617e3773d9d4ed1d2a') b2sums=('b2b3e60a956a4d55e12695d3a034832af321c57a3da6a907600062c723d8eb44b53473effb8346a3aef9e3423378e74e28b3f1d9ea643d19b4d7ebc4034880a6' '62cac1949c36ca2d6f74f72d83e953d9cc95d7cee60acb3f03afcdce71b00e10e3e22613c206858e94a1a91076917cb28d9b2a75133120a344a93fc4a6c6cefc'- 'SKIP')-b2sums_aarch64=('0d80c59208284c1905564391ba3ac48ba1875904f6cb512a6eed12ad0154a528e669165e92afc7dfb06be8761014c6597d73195bc4bd41df7b21158f6780d7b6')-b2sums_x86_64=('6ca40bbc82fd12fef75417cfec457363defbcb6ac2077cadc39e188cfe566a3a713b4c79738fe8dcd5b76d6fdb577abebbe458bf7e9e5671e2d08e5e6e9465fc')+ '234729d2ff102638d649e46aa7da193f3a46af396cf063876cbabb71b946ef2df4731519acc48f87e2a2d51f52e45ce494e04320a3fa006fbe5fb734820f51d8')+b2sums_aarch64=('e9a83fde7f4d7025e94e6e520d090981d707de7efc11a332e4acc3f25ab48578138ab52add23c871a9fa18dcd168ab93053e9b28bc4e2b6497e706b8da8ce2ff')+b2sums_x86_64=('48813601eb57a9e8a91766e847fa1eb3826cf0ffc1925305def8b53d2cabf3dd90cbd427e87a52009176ae75b73c304debc5da33be87ba886b76b6a237613639') depends=(curl gtk3 openssl icu libxml2-legacy webkit2gtk-4.1) optdepends=( 'xorg-xwayland: wayland support'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 3 |
| 2026-10-31 03:57:49 | Medium | 3 |
| 2026-10-31 00:07:41 | Medium | 3 |
| 2026-10-30 00:29:30 | Medium | 3 |
| 2026-10-29 00:13:55 | Medium | 3 |
| 2026-10-28 00:06:54 | Medium | 3 |
| 2026-10-27 00:23:28 | Medium | 3 |
| 2026-10-26 00:12:40 | Medium | 3 |
| 2026-10-25 00:20:48 | Medium | 3 |
| 2026-10-24 00:14:55 | Medium | 3 |
| 2026-10-23 00:02:19 | Medium | 3 |
| 2026-10-22 00:13:10 | Medium | 3 |
| 2026-10-21 00:12:50 | Medium | 3 |
| 2026-10-20 00:10:31 | Medium | 3 |
| 2026-10-19 00:03:55 | Medium | 3 |
| 2026-10-18 00:06:55 | Medium | 3 |
| 2026-10-17 00:21:55 | Medium | 3 |
| 2026-10-16 23:16:14 | Medium | 3 |
| 2026-10-16 00:12:47 | Medium | 3 |
| 2026-10-15 00:28:05 | Medium | 3 |